News for hackers. Stuff that matters.

A comment on Termux: terminal emulator and Linux environment for Android.

Re:Termux: terminal emulator and Linux environment for Android by thekaleb on Tuesday April 26, 2016 @07:28AM (#11570912)
`apt update` runs over HTTP (no SSL)... Is this a common practice?

This is a nice package otherwise.

[ Parent | on HN ]
Re:Termux: terminal emulator and Linux environment for Android by tssva on Tuesday April 26, 2016 @09:42AM (#11571741)
Using HTTP for 'apt update' is common practice. Neither Debian or Ubuntu use https for their repositories. Instead the metadata for each repository is signed with a gpg key. The associated public key is distributed with the installation media and used to verify the metadata. The metadata includes checksums for the other files in the repository. Debian and Ubuntu include MD5, SHA-1 and SHA-256 checksums. Termux includes just the SHA-256 checksums. These checksums are used to verify the integrity of the other files in the repository.
[ Parent | on HN ]